diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeDiscoveryActivity.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeDiscoveryActivity.yaml index aef337782f0..f5f0cef91a2 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeDiscoveryActivity.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeDiscoveryActivity.yaml @@ -1,33 +1,1119 @@ id: 09b8dfc7-87b0-4215-b34b-bab363d685cb name: Snowflake - Possible discovery activity -description: | - 'Detects possible discovery activity.' +description: '''Detects possible discovery activity.'' + + ' severity: Medium -status : Available +status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - Discovery +- Discovery relevantTechniques: - - T1526 -query: | - let threshold = 20; - Snowflake - | where QueryType =~ 'SHOW' - | where QueryExecutionStatus =~ 'SUCCESS' - | summarize count() by TargetUsername, bin(TimeGenerated, 5m) - | where count_ > threshold - | extend AccountCustomEntity = TargetUsername +- T1526 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet threshold = 20;\nSnowflake\n| where QueryType =~ 'SHOW'\n| where\ + \ QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated,\ + \ 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.2 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeLongQueryProcessTime.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeLongQueryProcessTime.yaml index 1edc2437638..4667829fd3b 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeLongQueryProcessTime.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeLongQueryProcessTime.yaml @@ -1,30 +1,1118 @@ id: 1376f5e5-855a-4f88-8591-19eba4575a0f name: Snowflake - Abnormal query process time -description: | - 'Detects query with abnormal proccess time.' +description: '''Detects query with abnormal proccess time.'' + + ' severity: Medium status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - Impact +- Impact relevantTechniques: - - T1499 -query: | - let threshold = 10000; - Snowflake - | where QueryTotalElapsedTime > threshold - | extend AccountCustomEntity = TargetUsername +- T1499 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet threshold = 10000;\nSnowflake\n| where QueryTotalElapsedTime\ + \ > threshold\n| extend AccountCustomEntity = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.1 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml index 7c9c058bb49..3e008bdfdf1 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml @@ -1,35 +1,1121 @@ id: 5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8 name: Snowflake - Multiple failed queries -description: | - 'Detects multiple failed queries in short timeframe.' +description: '''Detects multiple failed queries in short timeframe.'' + + ' severity: High status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - Discovery +- Discovery relevantTechniques: - - T1518 - - T1082 -query: | - let threshold = 50; - Snowflake - | where isnotempty(QueryExecutionStatus) - | where QueryExecutionStatus !~ 'SUCCESS' - | summarize count() by TargetUsername, bin(TimeGenerated, 5m) - | where count_ > threshold - | extend AccountCustomEntity = TargetUsername +- T1518 +- T1082 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet threshold = 50;\nSnowflake\n| where isnotempty(QueryExecutionStatus)\n\ + | where QueryExecutionStatus !~ 'SUCCESS'\n| summarize count() by TargetUsername,\ + \ bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity\ + \ = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.3 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled - diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailure.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailure.yaml index 549eb4bbe23..4e5fa07bbd3 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailure.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailure.yaml @@ -1,33 +1,1119 @@ id: e05cc333-d499-430f-907c-7f28a9e4d1b5 name: Snowflake - Multiple login failures by user -description: | - 'Detects multiple login failures by user.' +description: '''Detects multiple login failures by user.'' + + ' severity: High status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - InitialAccess +- InitialAccess relevantTechniques: - - T1078 -query: | - let threshold = 10; - Snowflake - | where EventType =~ 'LOGIN' - | where LoginIsSuccess =~ 'No' - | summarize count() by TargetUsername, bin(TimeGenerated, 5m) - | where count_ > threshold - | extend AccountCustomEntity = TargetUsername +- T1078 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet threshold = 10;\nSnowflake\n| where EventType =~ 'LOGIN'\n| where\ + \ LoginIsSuccess =~ 'No'\n| summarize count() by TargetUsername, bin(TimeGenerated,\ + \ 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.2 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailureFromIP.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailureFromIP.yaml index 44f3164d5f6..125185f4ee5 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailureFromIP.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailureFromIP.yaml @@ -1,33 +1,1119 @@ id: b7d22407-1391-4256-b09a-414a9719443c name: Snowflake - Multiple login failures from single IP -description: | - 'Detects Mmltiple login failures from single IP.' +description: '''Detects Mmltiple login failures from single IP.'' + + ' severity: High status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - InitialAccess +- InitialAccess relevantTechniques: - - T1078 -query: | - let threshold = 10; - Snowflake - | where EventType =~ 'LOGIN' - | where LoginIsSuccess =~ 'No' - | summarize count() by SrcDvcIpAddr, bin(TimeGenerated, 5m) - | where count_ > threshold - | extend IPCustomEntity = SrcDvcIpAddr +- T1078 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet threshold = 10;\nSnowflake\n| where EventType =~ 'LOGIN'\n| where\ + \ LoginIsSuccess =~ 'No'\n| summarize count() by SrcDvcIpAddr, bin(TimeGenerated,\ + \ 5m)\n| where count_ > threshold\n| extend IPCustomEntity = SrcDvcIpAddr\n" entityMappings: - - entityType: IP - fieldMappings: - - identifier: Address - columnName: IPCustomEntity -version: 1.0.2 +- entityType: IP + fieldMappings: + - identifier: Address + columnName: IPCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakePossibleDataDestruction.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakePossibleDataDestruction.yaml index 3066f06ab21..b15bfc5d94e 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakePossibleDataDestruction.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakePossibleDataDestruction.yaml @@ -1,33 +1,1119 @@ id: c2f93727-e4b0-4cb9-8f80-f52ebbd96ece name: Snowflake - Possible data destraction -description: | - 'Detects possible data destruction.' +description: '''Detects possible data destruction.'' + + ' severity: Medium status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - Impact +- Impact relevantTechniques: - - T1485 -query: | - let threshold = 10; - Snowflake - | where QueryType =~ 'DROP' - | where QueryExecutionStatus =~ 'SUCCESS' - | summarize count() by TargetUsername, bin(TimeGenerated, 5m) - | where count_ > threshold - | extend AccountCustomEntity = TargetUsername +- T1485 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet threshold = 10;\nSnowflake\n| where QueryType =~ 'DROP'\n| where\ + \ QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated,\ + \ 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.1 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakePrivilegesDiscovery.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakePrivilegesDiscovery.yaml index 6bba84b6e0f..87831c135b8 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakePrivilegesDiscovery.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakePrivilegesDiscovery.yaml @@ -1,30 +1,1118 @@ id: 627a4ff1-036b-4375-a9f9-288d5e1d7d37 name: Snowflake - Possible privileges discovery activity -description: | - 'Detects possible privileges discovery activity.' +description: '''Detects possible privileges discovery activity.'' + + ' severity: Medium status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - Discovery +- Discovery relevantTechniques: - - T1087 -query: | - Snowflake - | where QueryType =~ 'SHOW' - | where QueryText has_all ('SHOW', 'ROLES') - | extend AccountCustomEntity = TargetUsername +- T1087 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nSnowflake\n| where QueryType =~ 'SHOW'\n| where QueryText has_all\ + \ ('SHOW', 'ROLES')\n| extend AccountCustomEntity = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.1 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeQueryOnSensitiveTable.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeQueryOnSensitiveTable.yaml index 1027b166b15..89ac01afe4b 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeQueryOnSensitiveTable.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeQueryOnSensitiveTable.yaml @@ -1,33 +1,1120 @@ id: f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e name: Snowflake - Query on sensitive or restricted table -description: | - 'Detects query on sensitive or restricted table.' +description: '''Detects query on sensitive or restricted table.'' + + ' severity: Medium status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - Collection +- Collection relevantTechniques: - - T1119 -query: | - let r_tbl = dynamic(['table_name']); - Snowflake - | where QueryType =~ 'SELECT' - | where QueryExecutionStatus =~ 'SUCCESS' - | extend tbl = extract(@'(FROM|from)\s(\S+)\s', 2, QueryText) - | where tbl in~ (r_tbl) - | extend AccountCustomEntity = TargetUsername +- T1119 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet r_tbl = dynamic(['table_name']);\nSnowflake\n| where QueryType\ + \ =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| extend tbl = extract(@'(FROM|from)\\\ + s(\\S+)\\s', 2, QueryText)\n| where tbl in~ (r_tbl)\n| extend AccountCustomEntity\ + \ = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.1 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeUnusualQuery.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeUnusualQuery.yaml index 0b78b917949..30a15a04592 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeUnusualQuery.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeUnusualQuery.yaml @@ -1,31 +1,1119 @@ id: 1dd1d9e5-3ebf-43cb-be07-6082d5eabe79 name: Snowflake - Unusual query -description: | - 'Detects unusual query.' +description: '''Detects unusual query.'' + + ' severity: Medium status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - Collection +- Collection relevantTechniques: - - T1119 -query: | - Snowflake - | where QueryType =~ 'SELECT' - | where QueryExecutionStatus =~ 'SUCCESS' - | where QueryText startswith @'SELECT *' - | extend AccountCustomEntity = TargetUsername +- T1119 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nSnowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus\ + \ =~ 'SUCCESS'\n| where QueryText startswith @'SELECT *'\n| extend AccountCustomEntity\ + \ = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.1 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeUserAddAdminPrivileges.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeUserAddAdminPrivileges.yaml index ca5c3efbc3a..02e0a55c4dd 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeUserAddAdminPrivileges.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeUserAddAdminPrivileges.yaml @@ -1,34 +1,1121 @@ id: 5ed33eee-0ab6-4bf5-9e9b-6100db83d39a name: Snowflake - User granted admin privileges -description: | - 'Detects when user asigned admin privileges.' +description: '''Detects when user asigned admin privileges.'' + + ' severity: Medium status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - PrivilegeEscalation +- PrivilegeEscalation relevantTechniques: - - T1078 -query: | - let adm_roles = dynamic(['SECURITYADMIN', 'SYSADMIN', 'ACCOUNTADMIN']); - Snowflake - | where QueryType =~ 'GRANT' - | where QueryText startswith 'GRANT ROLE' - | extend granted_role = extract(@'GRANT ROLE\s(\S+)\sto\suser', 1, QueryText) - | where granted_role in~ (adm_roles) - | extend usr = extract(@'GRANT ROLE\s(\S+)\sto\suser(\S+)', 2, QueryText) - | extend AccountCustomEntity = usr +- T1078 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet adm_roles = dynamic(['SECURITYADMIN', 'SYSADMIN', 'ACCOUNTADMIN']);\n\ + Snowflake\n| where QueryType =~ 'GRANT'\n| where QueryText startswith 'GRANT ROLE'\n\ + | extend granted_role = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser', 1, QueryText)\n\ + | where granted_role in~ (adm_roles)\n| extend usr = extract(@'GRANT ROLE\\s(\\\ + S+)\\sto\\suser(\\S+)', 2, QueryText)\n| extend AccountCustomEntity = usr\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.1 -kind: Scheduled \ No newline at end of file +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 +kind: Scheduled diff --git a/Solutions/Snowflake/Data/Solution_Snowflake.json b/Solutions/Snowflake/Data/Solution_Snowflake.json index e4d5d88efda..6a17167dc21 100644 --- a/Solutions/Snowflake/Data/Solution_Snowflake.json +++ b/Solutions/Snowflake/Data/Solution_Snowflake.json @@ -38,7 +38,20 @@ ], "Metadata": "SolutionMetadata.json", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Snowflake", - "Version": "3.2.0", "TemplateSpec": true, - "Is1PConnector": false + "Is1PConnector": false, + "XDR Workbooks": [], + "XDR Detections": [ + "XDR Detections/SnowflakeDiscoveryActivity.yaml", + "XDR Detections/SnowflakeLongQueryProcessTime.yaml", + "XDR Detections/SnowflakeMultipleFailedQueries.yaml", + "XDR Detections/SnowflakeMultipleLoginFailure.yaml", + "XDR Detections/SnowflakeMultipleLoginFailureFromIP.yaml", + "XDR Detections/SnowflakePossibleDataDestruction.yaml", + "XDR Detections/SnowflakePrivilegesDiscovery.yaml", + "XDR Detections/SnowflakeQueryOnSensitiveTable.yaml", + "XDR Detections/SnowflakeUnusualQuery.yaml", + "XDR Detections/SnowflakeUserAddAdminPrivileges.yaml" + ], + "Version": "3.2.2" } diff --git a/Solutions/Snowflake/Package/3.2.2.zip b/Solutions/Snowflake/Package/3.2.2.zip new file mode 100644 index 00000000000..5aafa3b71b4 Binary files /dev/null and b/Solutions/Snowflake/Package/3.2.2.zip differ diff --git a/Solutions/Snowflake/Package/createUiDefinition.json b/Solutions/Snowflake/Package/createUiDefinition.json index 1e5fa138723..bf86b82d5f0 100644 --- a/Solutions/Snowflake/Package/createUiDefinition.json +++ b/Solutions/Snowflake/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Snowflake/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Snowflake CCF data connector provides the capability to ingest Snowflake [Login History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/login_history), [Query History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/query_history), [User-Grant Logs](https://docs.snowflake.com/en/sql-reference/account-usage/grants_to_users), [Role-Grant Logs](https://docs.snowflake.com/en/sql-reference/account-usage/grants_to_roles), [Load History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/load_history), [Materialized View Refresh History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/materialized_view_refresh_history), [Roles Logs](https://docs.snowflake.com/en/sql-reference/account-usage/roles), [Tables Logs](https://docs.snowflake.com/en/sql-reference/account-usage/tables), [Table Storage Metrics Logs](https://docs.snowflake.com/en/sql-reference/account-usage/table_storage_metrics), [Users Logs](https://docs.snowflake.com/en/sql-reference/account-usage/users) into Microsoft Sentinel using the Snowflake SQL API. Refer to [Snowflake SQL API documentation](https://docs.snowflake.com/en/developer-guide/sql-api/reference) for more information. \n\n **Underlying Microsoft Technologies used:** \n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n • [Microsoft Sentinel Codeless Connector Framework](https://aka.ms/Sentinel-CCP_Platform)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Snowflake/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Snowflake CCF data connector provides the capability to ingest Snowflake [Login History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/login_history), [Query History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/query_history), [User-Grant Logs](https://docs.snowflake.com/en/sql-reference/account-usage/grants_to_users), [Role-Grant Logs](https://docs.snowflake.com/en/sql-reference/account-usage/grants_to_roles), [Load History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/load_history), [Materialized View Refresh History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/materialized_view_refresh_history), [Roles Logs](https://docs.snowflake.com/en/sql-reference/account-usage/roles), [Tables Logs](https://docs.snowflake.com/en/sql-reference/account-usage/tables), [Table Storage Metrics Logs](https://docs.snowflake.com/en/sql-reference/account-usage/table_storage_metrics), [Users Logs](https://docs.snowflake.com/en/sql-reference/account-usage/users) into Microsoft Sentinel using the Snowflake SQL API. Refer to [Snowflake SQL API documentation](https://docs.snowflake.com/en/developer-guide/sql-api/reference) for more information. \n\n **Underlying Microsoft Technologies used:** \n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n • [Microsoft Sentinel Codeless Connector Framework](https://aka.ms/Sentinel-CCP_Platform)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **XDR Detections:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -51,6 +51,54 @@ } ], "steps": [ + { + "name": "contentSelection", + "label": "Content selection", + "elements": [ + { + "name": "DeployAnalyticsRule", + "type": "Microsoft.Common.CheckBox", + "label": "DeployAnalyticsRule", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + }, + { + "name": "DeployWorkbook", + "type": "Microsoft.Common.CheckBox", + "label": "DeployWorkbook", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + }, + { + "name": "DeployDataConnector", + "type": "Microsoft.Common.CheckBox", + "label": "DeployDataConnector", + "defaultValue": true, + "toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + }, + { + "name": "DeployCustomDetection", + "type": "Microsoft.Common.CheckBox", + "label": "DeployCustomDetection", + "defaultValue": false, + "toolTip": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + }, + { + "name": "DeployHuntingQuery", + "type": "Microsoft.Common.CheckBox", + "label": "DeployHuntingQuery", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + }, + { + "name": "DeployParser", + "type": "Microsoft.Common.CheckBox", + "label": "DeployParser", + "defaultValue": true, + "toolTip": "Deploy the parsers and their registrations carried by this solution." + } + ] + }, { "name": "dataconnectors", "label": "Data Connectors", @@ -453,7 +501,13 @@ "outputs": { "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", "location": "[location()]", - "workspace": "[basics('workspace')]" + "workspace": "[basics('workspace')]", + "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]", + "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]", + "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]", + "DeployCustomDetection": "[steps('contentSelection').DeployCustomDetection]", + "DeployHuntingQuery": "[steps('contentSelection').DeployHuntingQuery]", + "DeployParser": "[steps('contentSelection').DeployParser]" } } } diff --git a/Solutions/Snowflake/Package/mainTemplate.json b/Solutions/Snowflake/Package/mainTemplate.json index c42fe606959..1074f0b70a9 100644 --- a/Solutions/Snowflake/Package/mainTemplate.json +++ b/Solutions/Snowflake/Package/mainTemplate.json @@ -49,87 +49,129 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployDataConnector": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployHuntingQuery": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + } + }, + "DeployParser": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the parsers and their registrations carried by this solution." + } } }, "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Snowflake", - "_solutionVersion": "3.2.0", + "_solutionVersion": "3.2.2", "solutionId": "azuresentinel.azure-sentinel-solution-snowflake", "_solutionId": "[variables('solutionId')]", "analyticRuleObject1": { - "analyticRuleVersion1": "1.0.2", + "analyticRuleVersion1": "3.2.1", "_analyticRulecontentId1": "09b8dfc7-87b0-4215-b34b-bab363d685cb", "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '09b8dfc7-87b0-4215-b34b-bab363d685cb')]", "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('09b8dfc7-87b0-4215-b34b-bab363d685cb')))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','09b8dfc7-87b0-4215-b34b-bab363d685cb','-', '1.0.2')))]" + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','09b8dfc7-87b0-4215-b34b-bab363d685cb','-', '3.2.1')))]" }, "analyticRuleObject2": { - "analyticRuleVersion2": "1.0.1", + "analyticRuleVersion2": "3.2.1", "_analyticRulecontentId2": "1376f5e5-855a-4f88-8591-19eba4575a0f", "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1376f5e5-855a-4f88-8591-19eba4575a0f')]", "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1376f5e5-855a-4f88-8591-19eba4575a0f')))]", - "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1376f5e5-855a-4f88-8591-19eba4575a0f','-', '1.0.1')))]" + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1376f5e5-855a-4f88-8591-19eba4575a0f','-', '3.2.1')))]" }, "analyticRuleObject3": { - "analyticRuleVersion3": "1.0.3", + "analyticRuleVersion3": "3.2.1", "_analyticRulecontentId3": "5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8", "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')]", "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')))]", - "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8','-', '1.0.3')))]" + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8','-', '3.2.1')))]" }, "analyticRuleObject4": { - "analyticRuleVersion4": "1.0.2", + "analyticRuleVersion4": "3.2.1", "_analyticRulecontentId4": "e05cc333-d499-430f-907c-7f28a9e4d1b5", "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e05cc333-d499-430f-907c-7f28a9e4d1b5')]", "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e05cc333-d499-430f-907c-7f28a9e4d1b5')))]", - "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e05cc333-d499-430f-907c-7f28a9e4d1b5','-', '1.0.2')))]" + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e05cc333-d499-430f-907c-7f28a9e4d1b5','-', '3.2.1')))]" }, "analyticRuleObject5": { - "analyticRuleVersion5": "1.0.2", + "analyticRuleVersion5": "3.2.1", "_analyticRulecontentId5": "b7d22407-1391-4256-b09a-414a9719443c", "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b7d22407-1391-4256-b09a-414a9719443c')]", "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b7d22407-1391-4256-b09a-414a9719443c')))]", - "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b7d22407-1391-4256-b09a-414a9719443c','-', '1.0.2')))]" + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b7d22407-1391-4256-b09a-414a9719443c','-', '3.2.1')))]" }, "analyticRuleObject6": { - "analyticRuleVersion6": "1.0.1", + "analyticRuleVersion6": "3.2.1", "_analyticRulecontentId6": "c2f93727-e4b0-4cb9-8f80-f52ebbd96ece", "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c2f93727-e4b0-4cb9-8f80-f52ebbd96ece')]", "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c2f93727-e4b0-4cb9-8f80-f52ebbd96ece')))]", - "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c2f93727-e4b0-4cb9-8f80-f52ebbd96ece','-', '1.0.1')))]" + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c2f93727-e4b0-4cb9-8f80-f52ebbd96ece','-', '3.2.1')))]" }, "analyticRuleObject7": { - "analyticRuleVersion7": "1.0.1", + "analyticRuleVersion7": "3.2.1", "_analyticRulecontentId7": "627a4ff1-036b-4375-a9f9-288d5e1d7d37", "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '627a4ff1-036b-4375-a9f9-288d5e1d7d37')]", "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('627a4ff1-036b-4375-a9f9-288d5e1d7d37')))]", - "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','627a4ff1-036b-4375-a9f9-288d5e1d7d37','-', '1.0.1')))]" + "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','627a4ff1-036b-4375-a9f9-288d5e1d7d37','-', '3.2.1')))]" }, "analyticRuleObject8": { - "analyticRuleVersion8": "1.0.1", + "analyticRuleVersion8": "3.2.1", "_analyticRulecontentId8": "f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e", "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e')]", "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e')))]", - "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e','-', '1.0.1')))]" + "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e','-', '3.2.1')))]" }, "analyticRuleObject9": { - "analyticRuleVersion9": "1.0.1", + "analyticRuleVersion9": "3.2.1", "_analyticRulecontentId9": "1dd1d9e5-3ebf-43cb-be07-6082d5eabe79", "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1dd1d9e5-3ebf-43cb-be07-6082d5eabe79')]", "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1dd1d9e5-3ebf-43cb-be07-6082d5eabe79')))]", - "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1dd1d9e5-3ebf-43cb-be07-6082d5eabe79','-', '1.0.1')))]" + "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1dd1d9e5-3ebf-43cb-be07-6082d5eabe79','-', '3.2.1')))]" }, "analyticRuleObject10": { - "analyticRuleVersion10": "1.0.1", + "analyticRuleVersion10": "3.2.1", "_analyticRulecontentId10": "5ed33eee-0ab6-4bf5-9e9b-6100db83d39a", "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5ed33eee-0ab6-4bf5-9e9b-6100db83d39a')]", "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5ed33eee-0ab6-4bf5-9e9b-6100db83d39a')))]", - "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5ed33eee-0ab6-4bf5-9e9b-6100db83d39a','-', '1.0.1')))]" + "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5ed33eee-0ab6-4bf5-9e9b-6100db83d39a','-', '3.2.1')))]" }, "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "dataConnectorCCPVersion": "3.2.0", + "dataConnectorCCPVersion": "3.2.2", "_dataConnectorContentIdConnectorDefinition1": "SnowflakeConnector", "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", "_dataConnectorContentIdConnections1": "SnowflakeConnectorConnections", @@ -211,7 +253,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeDiscoveryActivity_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeDiscoveryActivity_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -228,7 +270,7 @@ "description": "Detects possible discovery activity.", "displayName": "Snowflake - Possible discovery activity", "enabled": false, - "query": "let threshold = 20;\nSnowflake\n| where QueryType =~ 'SHOW'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 20;\nSnowflake\n| where QueryType =~ 'SHOW'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -253,13 +295,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -304,7 +346,8 @@ "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -315,7 +358,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeLongQueryProcessTime_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeLongQueryProcessTime_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -332,7 +375,7 @@ "description": "Detects query with abnormal proccess time.", "displayName": "Snowflake - Abnormal query process time", "enabled": false, - "query": "let threshold = 10000;\nSnowflake\n| where QueryTotalElapsedTime > threshold\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10000;\nSnowflake\n| where QueryTotalElapsedTime > threshold\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -357,13 +400,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -408,7 +451,8 @@ "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -419,7 +463,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeMultipleFailedQueries_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeMultipleFailedQueries_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -436,7 +480,7 @@ "description": "Detects multiple failed queries in short timeframe.", "displayName": "Snowflake - Multiple failed queries", "enabled": false, - "query": "let threshold = 50;\nSnowflake\n| where isnotempty(QueryExecutionStatus)\n| where QueryExecutionStatus !~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 50;\nSnowflake\n| where isnotempty(QueryExecutionStatus)\n| where QueryExecutionStatus !~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "High", @@ -462,13 +506,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -513,7 +557,8 @@ "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -524,7 +569,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeMultipleLoginFailure_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeMultipleLoginFailure_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -541,7 +586,7 @@ "description": "Detects multiple login failures by user.", "displayName": "Snowflake - Multiple login failures by user", "enabled": false, - "query": "let threshold = 10;\nSnowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\nSnowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "High", @@ -566,13 +611,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -617,7 +662,8 @@ "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -628,7 +674,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeMultipleLoginFailureFromIP_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeMultipleLoginFailureFromIP_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -645,7 +691,7 @@ "description": "Detects Mmltiple login failures from single IP.", "displayName": "Snowflake - Multiple login failures from single IP", "enabled": false, - "query": "let threshold = 10;\nSnowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by SrcDvcIpAddr, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend IPCustomEntity = SrcDvcIpAddr\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\nSnowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by SrcDvcIpAddr, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend IPCustomEntity = SrcDvcIpAddr\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "High", @@ -670,13 +716,13 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "IPCustomEntity" + "columnName": "IPCustomEntity", + "identifier": "Address" } - ] + ], + "entityType": "IP" } ] } @@ -721,7 +767,8 @@ "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -732,7 +779,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakePossibleDataDestruction_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakePossibleDataDestruction_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -749,7 +796,7 @@ "description": "Detects possible data destruction.", "displayName": "Snowflake - Possible data destraction", "enabled": false, - "query": "let threshold = 10;\nSnowflake\n| where QueryType =~ 'DROP'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\nSnowflake\n| where QueryType =~ 'DROP'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -774,13 +821,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -825,7 +872,8 @@ "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -836,7 +884,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakePrivilegesDiscovery_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakePrivilegesDiscovery_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -853,7 +901,7 @@ "description": "Detects possible privileges discovery activity.", "displayName": "Snowflake - Possible privileges discovery activity", "enabled": false, - "query": "Snowflake\n| where QueryType =~ 'SHOW'\n| where QueryText has_all ('SHOW', 'ROLES')\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nSnowflake\n| where QueryType =~ 'SHOW'\n| where QueryText has_all ('SHOW', 'ROLES')\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -878,13 +926,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -929,7 +977,8 @@ "contentProductId": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", "id": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -940,7 +989,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeQueryOnSensitiveTable_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeQueryOnSensitiveTable_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -957,7 +1006,7 @@ "description": "Detects query on sensitive or restricted table.", "displayName": "Snowflake - Query on sensitive or restricted table", "enabled": false, - "query": "let r_tbl = dynamic(['table_name']);\nSnowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| extend tbl = extract(@'(FROM|from)\\s(\\S+)\\s', 2, QueryText)\n| where tbl in~ (r_tbl)\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet r_tbl = dynamic(['table_name']);\nSnowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| extend tbl = extract(@'(FROM|from)\\s(\\S+)\\s', 2, QueryText)\n| where tbl in~ (r_tbl)\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -982,13 +1031,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -1033,7 +1082,8 @@ "contentProductId": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", "id": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1044,7 +1094,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeUnusualQuery_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeUnusualQuery_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -1061,7 +1111,7 @@ "description": "Detects unusual query.", "displayName": "Snowflake - Unusual query", "enabled": false, - "query": "Snowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| where QueryText startswith @'SELECT *'\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nSnowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| where QueryText startswith @'SELECT *'\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -1086,13 +1136,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -1137,7 +1187,8 @@ "contentProductId": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", "id": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1148,7 +1199,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeUserAddAdminPrivileges_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeUserAddAdminPrivileges_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -1165,7 +1216,7 @@ "description": "Detects when user asigned admin privileges.", "displayName": "Snowflake - User granted admin privileges", "enabled": false, - "query": "let adm_roles = dynamic(['SECURITYADMIN', 'SYSADMIN', 'ACCOUNTADMIN']);\nSnowflake\n| where QueryType =~ 'GRANT'\n| where QueryText startswith 'GRANT ROLE'\n| extend granted_role = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser', 1, QueryText)\n| where granted_role in~ (adm_roles)\n| extend usr = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser(\\S+)', 2, QueryText)\n| extend AccountCustomEntity = usr\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet adm_roles = dynamic(['SECURITYADMIN', 'SYSADMIN', 'ACCOUNTADMIN']);\nSnowflake\n| where QueryType =~ 'GRANT'\n| where QueryText startswith 'GRANT ROLE'\n| extend granted_role = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser', 1, QueryText)\n| where granted_role in~ (adm_roles)\n| extend usr = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser(\\S+)', 2, QueryText)\n| extend AccountCustomEntity = usr\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -1190,13 +1241,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -1241,7 +1292,8 @@ "contentProductId": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", "id": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", "version": "[variables('analyticRuleObject10').analyticRuleVersion10]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1615,7 +1667,8 @@ } ] } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", @@ -4259,7 +4312,8 @@ "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", @@ -4615,7 +4669,8 @@ } ] } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", @@ -4650,7 +4705,8 @@ } ] } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5371,7 +5427,8 @@ "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5382,7 +5439,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeAdminSources_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeAdminSources_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -5456,7 +5513,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5467,7 +5525,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeDeletedDatabases_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeDeletedDatabases_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -5541,7 +5599,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5552,7 +5611,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeDeletedTables_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeDeletedTables_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -5626,7 +5685,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5637,7 +5697,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeDormantUser_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeDormantUser_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -5711,7 +5771,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5722,7 +5783,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeFailedLogins_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeFailedLogins_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -5796,7 +5857,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5807,7 +5869,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeHighCreditConsumingQueries_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeHighCreditConsumingQueries_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", @@ -5881,7 +5943,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5892,7 +5955,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeTimeConsumingQueries_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeTimeConsumingQueries_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", @@ -5966,7 +6029,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5977,7 +6041,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeUnknownQueryType_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeUnknownQueryType_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]", @@ -6051,7 +6115,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -6062,7 +6127,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeUnusedAdmins_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeUnusedAdmins_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]", @@ -6136,7 +6201,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -6147,7 +6213,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeUserSources_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeUserSources_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]", @@ -6221,7 +6287,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -6232,7 +6299,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Snowflake Data Parser with template version 3.2.0", + "description": "Snowflake Data Parser with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -6302,7 +6369,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '2.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '2.0.0')))]", "version": "[variables('parserObject1').parserVersion1]" - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", @@ -6323,7 +6391,8 @@ "value": "" } ] - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -6353,7 +6422,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -6364,7 +6434,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Snowflake Workbook with template version 3.2.0", + "description": "Snowflake Workbook with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -6441,19 +6511,20 @@ "contentProductId": "[variables('_workbookcontentProductId1')]", "id": "[variables('_workbookcontentProductId1')]", "version": "[variables('workbookVersion1')]" - } + }, + "condition": "[parameters('DeployWorkbook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.2.0", + "version": "3.2.2", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Snowflake", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Snowflake CCF data connector provides the capability to ingest Snowflake Login History Logs, Query History Logs, User-Grant Logs, Role-Grant Logs, Load History Logs, Materialized View Refresh History Logs, Roles Logs, Tables Logs, Table Storage Metrics Logs, Users Logs into Microsoft Sentinel using the Snowflake SQL API. Refer to Snowflake SQL API documentation for more information.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n

• Microsoft Sentinel Codeless Connector Framework

\n

Data Connectors: 1, Parsers: 1, Workbooks: 1, Analytic Rules: 10, Hunting Queries: 10

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Snowflake CCF data connector provides the capability to ingest Snowflake Login History Logs, Query History Logs, User-Grant Logs, Role-Grant Logs, Load History Logs, Materialized View Refresh History Logs, Roles Logs, Tables Logs, Table Storage Metrics Logs, Users Logs into Microsoft Sentinel using the Snowflake SQL API. Refer to Snowflake SQL API documentation for more information.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n

• Microsoft Sentinel Codeless Connector Framework

\n

Data Connectors: 1, Parsers: 1, Workbooks: 1, Analytic Rules: 10, XDR Detections: 10, Hunting Queries: 10

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -6592,6 +6663,56 @@ "kind": "Workbook", "contentId": "[variables('_workbookContentId1')]", "version": "[variables('workbookVersion1')]" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-1376f5e5-855a-4f88-8591-19eba4575a0f", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-b7d22407-1391-4256-b09a-414a9719443c", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a", + "version": "3.2.1" } ] }, @@ -6606,6 +6727,2125 @@ } }, "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Possible discovery activity", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 20;\n__xdr_inline_Snowflake\n| where QueryType =~ 'SHOW'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb', 'xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects possible discovery activity.'", + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1526" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Possible discovery activity", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects possible discovery activity.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Possible discovery activity", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 20;\n__xdr_inline_Snowflake\n| where QueryType =~ 'SHOW'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb', 'xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects possible discovery activity.'", + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1526" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Possible discovery activity", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Possible discovery activity", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-1376f5e5-855a-4f88-8591-19eba4575a0f", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Abnormal query process time", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10000;\n__xdr_inline_Snowflake\n| where QueryTotalElapsedTime > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-1376f5e5-855a-4f88-8591-19eba4575a0f', 'xdr-1376f5e5-855a-4f88-8591-19eba4575a0f')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects query with abnormal proccess time.'", + "tactics": [ + { + "tactic": "Impact", + "techniques": [ + { + "technique": "T1499" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Abnormal query process time", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-1376f5e5-855a-4f88-8591-19eba4575a0f", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-1376f5e5-855a-4f88-8591-19eba4575a0f')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-1376f5e5-855a-4f88-8591-19eba4575a0f')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects query with abnormal proccess time.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Abnormal query process time", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10000;\n__xdr_inline_Snowflake\n| where QueryTotalElapsedTime > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-1376f5e5-855a-4f88-8591-19eba4575a0f', 'xdr-1376f5e5-855a-4f88-8591-19eba4575a0f')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects query with abnormal proccess time.'", + "tactics": [ + { + "tactic": "Impact", + "techniques": [ + { + "technique": "T1499" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Abnormal query process time", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-1376f5e5-855a-4f88-8591-19eba4575a0f", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-1376f5e5-855a-4f88-8591-19eba4575a0f", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Abnormal query process time", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-1376f5e5-855a-4f88-8591-19eba4575a0f','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-1376f5e5-855a-4f88-8591-19eba4575a0f','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-1376f5e5-855a-4f88-8591-19eba4575a0f", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Multiple failed queries", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 50;\n__xdr_inline_Snowflake\n| where isnotempty(QueryExecutionStatus)\n| where QueryExecutionStatus !~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8', 'xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects multiple failed queries in short timeframe.'", + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1518" + }, + { + "technique": "T1082" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Multiple failed queries", + "severity": "high" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects multiple failed queries in short timeframe.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Multiple failed queries", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 50;\n__xdr_inline_Snowflake\n| where isnotempty(QueryExecutionStatus)\n| where QueryExecutionStatus !~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8', 'xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects multiple failed queries in short timeframe.'", + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1518" + }, + { + "technique": "T1082" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Multiple failed queries", + "severity": "high" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Multiple failed queries", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Multiple login failures by user", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\n__xdr_inline_Snowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5', 'xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects multiple login failures by user.'", + "tactics": [ + { + "tactic": "InitialAccess", + "techniques": [ + { + "technique": "T1078" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Multiple login failures by user", + "severity": "high" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects multiple login failures by user.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Multiple login failures by user", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\n__xdr_inline_Snowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5', 'xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects multiple login failures by user.'", + "tactics": [ + { + "tactic": "InitialAccess", + "techniques": [ + { + "technique": "T1078" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Multiple login failures by user", + "severity": "high" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Multiple login failures by user", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-b7d22407-1391-4256-b09a-414a9719443c", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Multiple login failures from single IP", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\n__xdr_inline_Snowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by SrcDvcIpAddr, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend IPCustomEntity = SrcDvcIpAddr" + }, + "id": "[if(true(), 'xdr-b7d22407-1391-4256-b09a-414a9719443c', 'xdr-b7d22407-1391-4256-b09a-414a9719443c')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects Mmltiple login failures from single IP.'", + "tactics": [ + { + "tactic": "InitialAccess", + "techniques": [ + { + "technique": "T1078" + } + ] + } + ], + "entityMappings": { + "ips": [ + { + "addressColumn": "IPCustomEntity", + "id": "[if(true(), 'ip1', 'ip1')]" + } + ] + }, + "title": "Snowflake - Multiple login failures from single IP", + "severity": "high" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-b7d22407-1391-4256-b09a-414a9719443c", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-b7d22407-1391-4256-b09a-414a9719443c')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-b7d22407-1391-4256-b09a-414a9719443c')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects Mmltiple login failures from single IP.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Multiple login failures from single IP", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\n__xdr_inline_Snowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by SrcDvcIpAddr, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend IPCustomEntity = SrcDvcIpAddr" + }, + "id": "[if(true(), 'xdr-b7d22407-1391-4256-b09a-414a9719443c', 'xdr-b7d22407-1391-4256-b09a-414a9719443c')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects Mmltiple login failures from single IP.'", + "tactics": [ + { + "tactic": "InitialAccess", + "techniques": [ + { + "technique": "T1078" + } + ] + } + ], + "entityMappings": { + "ips": [ + { + "addressColumn": "IPCustomEntity", + "id": "[if(true(), 'ip1', 'ip1')]" + } + ] + }, + "title": "Snowflake - Multiple login failures from single IP", + "severity": "high" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-b7d22407-1391-4256-b09a-414a9719443c", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-b7d22407-1391-4256-b09a-414a9719443c", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Multiple login failures from single IP", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-b7d22407-1391-4256-b09a-414a9719443c','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-b7d22407-1391-4256-b09a-414a9719443c','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-b7d22407-1391-4256-b09a-414a9719443c", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Possible data destraction", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\n__xdr_inline_Snowflake\n| where QueryType =~ 'DROP'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece', 'xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects possible data destruction.'", + "tactics": [ + { + "tactic": "Impact", + "techniques": [ + { + "technique": "T1485" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Possible data destraction", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects possible data destruction.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Possible data destraction", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\n__xdr_inline_Snowflake\n| where QueryType =~ 'DROP'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece', 'xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects possible data destruction.'", + "tactics": [ + { + "tactic": "Impact", + "techniques": [ + { + "technique": "T1485" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Possible data destraction", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Possible data destraction", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Possible privileges discovery activity", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\n__xdr_inline_Snowflake\n| where QueryType =~ 'SHOW'\n| where QueryText has_all ('SHOW', 'ROLES')\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37', 'xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects possible privileges discovery activity.'", + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1087" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Possible privileges discovery activity", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects possible privileges discovery activity.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Possible privileges discovery activity", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\n__xdr_inline_Snowflake\n| where QueryType =~ 'SHOW'\n| where QueryText has_all ('SHOW', 'ROLES')\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37', 'xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects possible privileges discovery activity.'", + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1087" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Possible privileges discovery activity", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Possible privileges discovery activity", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Query on sensitive or restricted table", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet r_tbl = dynamic(['table_name']);\n__xdr_inline_Snowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| extend tbl = extract(@'(FROM|from)\\s(\\S+)\\s', 2, QueryText)\n| where tbl in~ (r_tbl)\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e', 'xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects query on sensitive or restricted table.'", + "tactics": [ + { + "tactic": "Collection", + "techniques": [ + { + "technique": "T1119" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Query on sensitive or restricted table", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects query on sensitive or restricted table.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Query on sensitive or restricted table", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet r_tbl = dynamic(['table_name']);\n__xdr_inline_Snowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| extend tbl = extract(@'(FROM|from)\\s(\\S+)\\s', 2, QueryText)\n| where tbl in~ (r_tbl)\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e', 'xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects query on sensitive or restricted table.'", + "tactics": [ + { + "tactic": "Collection", + "techniques": [ + { + "technique": "T1119" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Query on sensitive or restricted table", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Query on sensitive or restricted table", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Unusual query", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\n__xdr_inline_Snowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| where QueryText startswith @'SELECT *'\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79', 'xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects unusual query.'", + "tactics": [ + { + "tactic": "Collection", + "techniques": [ + { + "technique": "T1119" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Unusual query", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects unusual query.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Unusual query", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\n__xdr_inline_Snowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| where QueryText startswith @'SELECT *'\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79', 'xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects unusual query.'", + "tactics": [ + { + "tactic": "Collection", + "techniques": [ + { + "technique": "T1119" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Unusual query", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Unusual query", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - User granted admin privileges", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet adm_roles = dynamic(['SECURITYADMIN', 'SYSADMIN', 'ACCOUNTADMIN']);\n__xdr_inline_Snowflake\n| where QueryType =~ 'GRANT'\n| where QueryText startswith 'GRANT ROLE'\n| extend granted_role = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser', 1, QueryText)\n| where granted_role in~ (adm_roles)\n| extend usr = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser(\\S+)', 2, QueryText)\n| extend AccountCustomEntity = usr" + }, + "id": "[if(true(), 'xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a', 'xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects when user asigned admin privileges.'", + "tactics": [ + { + "tactic": "PrivilegeEscalation", + "techniques": [ + { + "technique": "T1078" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - User granted admin privileges", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects when user asigned admin privileges.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - User granted admin privileges", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet adm_roles = dynamic(['SECURITYADMIN', 'SYSADMIN', 'ACCOUNTADMIN']);\n__xdr_inline_Snowflake\n| where QueryType =~ 'GRANT'\n| where QueryText startswith 'GRANT ROLE'\n| extend granted_role = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser', 1, QueryText)\n| where granted_role in~ (adm_roles)\n| extend usr = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser(\\S+)', 2, QueryText)\n| extend AccountCustomEntity = usr" + }, + "id": "[if(true(), 'xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a', 'xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects when user asigned admin privileges.'", + "tactics": [ + { + "tactic": "PrivilegeEscalation", + "techniques": [ + { + "technique": "T1078" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - User granted admin privileges", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a", + "contentKind": "CustomDetection", + "displayName": "Snowflake - User granted admin privileges", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "pid-951bc970-f49c-4e24-84f8-41ef45f7c4b0-partnercenter", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } } ], "outputs": {} diff --git a/Solutions/Snowflake/Package/testParameters.json b/Solutions/Snowflake/Package/testParameters.json index cd283e750cf..84ec110e772 100644 --- a/Solutions/Snowflake/Package/testParameters.json +++ b/Solutions/Snowflake/Package/testParameters.json @@ -42,5 +42,47 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployDataConnector": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployHuntingQuery": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + } + }, + "DeployParser": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the parsers and their registrations carried by this solution." + } } } diff --git a/Solutions/Snowflake/ReleaseNotes.md b/Solutions/Snowflake/ReleaseNotes.md index 59e5393ba57..add6bdfacc3 100644 --- a/Solutions/Snowflake/ReleaseNotes.md +++ b/Solutions/Snowflake/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------| +| 3.2.2 | 20-10-2026 | Added ten disabled Defender XDR Custom Detections alongside the existing Microsoft Sentinel content. Defender Workbook drafts remain excluded pending review. | | 3.2.0 | 22-09-2026 | Added V3 Snowflake tables for nested ingestion. | | 3.1.0 | 04-08-2026 | Updated **CCF Data Connector** to fix pagination and migrate to V2 tables | | 3.0.9 | 03-02-2026 | Updated the **analytic rule** query.| diff --git a/Solutions/Snowflake/SolutionMetadata.json b/Solutions/Snowflake/SolutionMetadata.json index ca525616dd0..093dc2db3eb 100644 --- a/Solutions/Snowflake/SolutionMetadata.json +++ b/Solutions/Snowflake/SolutionMetadata.json @@ -1,15 +1,21 @@ { - "publisherId": "azuresentinel", - "offerId": "azure-sentinel-solution-snowflake", - "firstPublishDate": "2021-10-23", - "providers": ["Snowflake"], - "categories": { - "domains" : ["Application"] - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } -} \ No newline at end of file + "trackingId": "pid-951bc970-f49c-4e24-84f8-41ef45f7c4b0-partnercenter", + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-snowflake", + "firstPublishDate": "2021-10-23", + "providers": [ + "Snowflake" + ], + "categories": { + "domains": [ + "Application" + ] + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "version": "3.2.2" +} diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeDiscoveryActivity.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeDiscoveryActivity.yaml new file mode 100644 index 00000000000..5d6211187c9 --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeDiscoveryActivity.yaml @@ -0,0 +1,1905 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 09b8dfc7-87b0-4215-b34b-bab363d685cb + path: Analytic Rules/SnowflakeDiscoveryActivity.yaml + version: 3.2.1 + querySha256: a023f3143dd0769525b5ffcc99329663eadc6d0c2155f07a7e2e6f69a09731fa + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - Discovery + originalTechniques: + - T1526 + reviewScope: + sourceDocumentSha256: a554a9b2927c77b3eece7d6a4e8beb75ffbb79ca664e44c6dcc43b08e570d8e2 + targetQuerySha256: 65b959bb8ba9410273248b99aac937600de1c2ec56ed04d88f3be3dad6c19be0 + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: a554a9b2927c77b3eece7d6a4e8beb75ffbb79ca664e44c6dcc43b08e570d8e2 + targetQuerySha256: 65b959bb8ba9410273248b99aac937600de1c2ec56ed04d88f3be3dad6c19be0 + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: a554a9b2927c77b3eece7d6a4e8beb75ffbb79ca664e44c6dcc43b08e570d8e2 + targetQuerySha256: 65b959bb8ba9410273248b99aac937600de1c2ec56ed04d88f3be3dad6c19be0 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: true + aggregationWindowDifference: true + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: Query contains summarize/make-series aggregation; evaluating over the native 4-hour XDR lookback + window without an injected 1h event-time filter may aggregate up to 4 hours of events per hourly run instead of 1 + hour. + sourceDocumentSha256: a554a9b2927c77b3eece7d6a4e8beb75ffbb79ca664e44c6dcc43b08e570d8e2 + targetQuerySha256: 65b959bb8ba9410273248b99aac937600de1c2ec56ed04d88f3be3dad6c19be0 + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb + displayName: Snowflake - Possible discovery activity + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let threshold = 20; + __xdr_inline_Snowflake + | where QueryType =~ 'SHOW' + | where QueryExecutionStatus =~ 'SUCCESS' + | summarize count() by TargetUsername, bin(TimeGenerated, 5m) + | where count_ > threshold + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Possible discovery activity + description: '''Detects possible discovery activity.''' + severity: medium + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: Discovery + techniques: + - technique: T1526 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeLongQueryProcessTime.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeLongQueryProcessTime.yaml new file mode 100644 index 00000000000..7d5dcb3ca6d --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeLongQueryProcessTime.yaml @@ -0,0 +1,1901 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 1376f5e5-855a-4f88-8591-19eba4575a0f + path: Analytic Rules/SnowflakeLongQueryProcessTime.yaml + version: 3.2.1 + querySha256: fee040321f8c00382b135488f65934f404221e11db313292aa9fb3a6e61a2fee + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - Impact + originalTechniques: + - T1499 + reviewScope: + sourceDocumentSha256: 62ae60b36433f806fd3ecdd17241ad8094719402c4d3f9e78d2e2003969b7f42 + targetQuerySha256: 6aacccbbd719c178f96a0fa17e29bafccac19cb741b64611c736e81d2949194f + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: 62ae60b36433f806fd3ecdd17241ad8094719402c4d3f9e78d2e2003969b7f42 + targetQuerySha256: 6aacccbbd719c178f96a0fa17e29bafccac19cb741b64611c736e81d2949194f + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: 62ae60b36433f806fd3ecdd17241ad8094719402c4d3f9e78d2e2003969b7f42 + targetQuerySha256: 6aacccbbd719c178f96a0fa17e29bafccac19cb741b64611c736e81d2949194f + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: 62ae60b36433f806fd3ecdd17241ad8094719402c4d3f9e78d2e2003969b7f42 + targetQuerySha256: 6aacccbbd719c178f96a0fa17e29bafccac19cb741b64611c736e81d2949194f + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-1376f5e5-855a-4f88-8591-19eba4575a0f + displayName: Snowflake - Abnormal query process time + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let threshold = 10000; + __xdr_inline_Snowflake + | where QueryTotalElapsedTime > threshold + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Abnormal query process time + description: '''Detects query with abnormal proccess time.''' + severity: medium + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: Impact + techniques: + - technique: T1499 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeMultipleFailedQueries.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeMultipleFailedQueries.yaml new file mode 100644 index 00000000000..a3f50884c8f --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeMultipleFailedQueries.yaml @@ -0,0 +1,1907 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8 + path: Analytic Rules/SnowflakeMultipleFailedQueries.yaml + version: 3.2.1 + querySha256: 47408aecd3f63b9c96509b776f918f9c671d372f4cc143a689db43f23a2a9b02 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - Discovery + originalTechniques: + - T1518 + - T1082 + reviewScope: + sourceDocumentSha256: e0c858c66dacf92aef1bfbec3fe62c61b075661f616b2c98e67d5da5931c35a2 + targetQuerySha256: 2cc6ce4ae525b4c3ace462286a9cde612c5182183ff28162cf9c3df4c8bd6e14 + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: e0c858c66dacf92aef1bfbec3fe62c61b075661f616b2c98e67d5da5931c35a2 + targetQuerySha256: 2cc6ce4ae525b4c3ace462286a9cde612c5182183ff28162cf9c3df4c8bd6e14 + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: e0c858c66dacf92aef1bfbec3fe62c61b075661f616b2c98e67d5da5931c35a2 + targetQuerySha256: 2cc6ce4ae525b4c3ace462286a9cde612c5182183ff28162cf9c3df4c8bd6e14 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: true + aggregationWindowDifference: true + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: Query contains summarize/make-series aggregation; evaluating over the native 4-hour XDR lookback + window without an injected 1h event-time filter may aggregate up to 4 hours of events per hourly run instead of 1 + hour. + sourceDocumentSha256: e0c858c66dacf92aef1bfbec3fe62c61b075661f616b2c98e67d5da5931c35a2 + targetQuerySha256: 2cc6ce4ae525b4c3ace462286a9cde612c5182183ff28162cf9c3df4c8bd6e14 + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8 + displayName: Snowflake - Multiple failed queries + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let threshold = 50; + __xdr_inline_Snowflake + | where isnotempty(QueryExecutionStatus) + | where QueryExecutionStatus !~ 'SUCCESS' + | summarize count() by TargetUsername, bin(TimeGenerated, 5m) + | where count_ > threshold + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Multiple failed queries + description: '''Detects multiple failed queries in short timeframe.''' + severity: high + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: Discovery + techniques: + - technique: T1518 + - technique: T1082 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeMultipleLoginFailure.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeMultipleLoginFailure.yaml new file mode 100644 index 00000000000..b1c13758e94 --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeMultipleLoginFailure.yaml @@ -0,0 +1,1905 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: e05cc333-d499-430f-907c-7f28a9e4d1b5 + path: Analytic Rules/SnowflakeMultipleLoginFailure.yaml + version: 3.2.1 + querySha256: 686f7f65d5ea5223a1a5c4a66fc07b9ef5cac19358f478b15653605a57da3788 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - InitialAccess + originalTechniques: + - T1078 + reviewScope: + sourceDocumentSha256: f153bcb47bda2bc0bcdaef9974aa11640a121fb6a964cbf337fc5f6e0474d213 + targetQuerySha256: a8b80e61897073a38d07afc383d6cdd1688db2f86f7bbd9d7da08360c38df2da + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: f153bcb47bda2bc0bcdaef9974aa11640a121fb6a964cbf337fc5f6e0474d213 + targetQuerySha256: a8b80e61897073a38d07afc383d6cdd1688db2f86f7bbd9d7da08360c38df2da + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: f153bcb47bda2bc0bcdaef9974aa11640a121fb6a964cbf337fc5f6e0474d213 + targetQuerySha256: a8b80e61897073a38d07afc383d6cdd1688db2f86f7bbd9d7da08360c38df2da + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: true + aggregationWindowDifference: true + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: Query contains summarize/make-series aggregation; evaluating over the native 4-hour XDR lookback + window without an injected 1h event-time filter may aggregate up to 4 hours of events per hourly run instead of 1 + hour. + sourceDocumentSha256: f153bcb47bda2bc0bcdaef9974aa11640a121fb6a964cbf337fc5f6e0474d213 + targetQuerySha256: a8b80e61897073a38d07afc383d6cdd1688db2f86f7bbd9d7da08360c38df2da + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5 + displayName: Snowflake - Multiple login failures by user + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let threshold = 10; + __xdr_inline_Snowflake + | where EventType =~ 'LOGIN' + | where LoginIsSuccess =~ 'No' + | summarize count() by TargetUsername, bin(TimeGenerated, 5m) + | where count_ > threshold + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Multiple login failures by user + description: '''Detects multiple login failures by user.''' + severity: high + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: InitialAccess + techniques: + - technique: T1078 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeMultipleLoginFailureFromIP.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeMultipleLoginFailureFromIP.yaml new file mode 100644 index 00000000000..3fba5609b6b --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeMultipleLoginFailureFromIP.yaml @@ -0,0 +1,1886 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: b7d22407-1391-4256-b09a-414a9719443c + path: Analytic Rules/SnowflakeMultipleLoginFailureFromIP.yaml + version: 3.2.1 + querySha256: ffd706869b970307288b0874a8b64ef1320e0ef8689e14cc7a57258d813ed907 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + informational: [] + errors: [] + originalTactics: + - InitialAccess + originalTechniques: + - T1078 + reviewScope: + sourceDocumentSha256: b2ea390295d61c68c3ab7538ddffe618c477a1c8266a07ee43354d6419787641 + targetQuerySha256: 069137e67a16f0147700044d7b90ff9f4a2c00bb2db37506684a5d5b1d3e038b + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: b2ea390295d61c68c3ab7538ddffe618c477a1c8266a07ee43354d6419787641 + targetQuerySha256: 069137e67a16f0147700044d7b90ff9f4a2c00bb2db37506684a5d5b1d3e038b + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: true + aggregationWindowDifference: true + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: Query contains summarize/make-series aggregation; evaluating over the native 4-hour XDR lookback + window without an injected 1h event-time filter may aggregate up to 4 hours of events per hourly run instead of 1 + hour. + sourceDocumentSha256: b2ea390295d61c68c3ab7538ddffe618c477a1c8266a07ee43354d6419787641 + targetQuerySha256: 069137e67a16f0147700044d7b90ff9f4a2c00bb2db37506684a5d5b1d3e038b + acceptedReviewReasons: + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-b7d22407-1391-4256-b09a-414a9719443c + displayName: Snowflake - Multiple login failures from single IP + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let threshold = 10; + __xdr_inline_Snowflake + | where EventType =~ 'LOGIN' + | where LoginIsSuccess =~ 'No' + | summarize count() by SrcDvcIpAddr, bin(TimeGenerated, 5m) + | where count_ > threshold + | extend IPCustomEntity = SrcDvcIpAddr + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Multiple login failures from single IP + description: '''Detects Mmltiple login failures from single IP.''' + severity: high + entityMappings: + ips: + - id: ip1 + addressColumn: IPCustomEntity + tactics: + - tactic: InitialAccess + techniques: + - technique: T1078 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakePossibleDataDestruction.yaml b/Solutions/Snowflake/XDR Detections/SnowflakePossibleDataDestruction.yaml new file mode 100644 index 00000000000..f293ab0dcf8 --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakePossibleDataDestruction.yaml @@ -0,0 +1,1905 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: c2f93727-e4b0-4cb9-8f80-f52ebbd96ece + path: Analytic Rules/SnowflakePossibleDataDestruction.yaml + version: 3.2.1 + querySha256: 0d95c4e8d4ff8ea489805ad78ac9051f927b7ed46dcbab83ad9621d99f382185 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - Impact + originalTechniques: + - T1485 + reviewScope: + sourceDocumentSha256: f52bb3503b7558bd95b70cbdb9b8791d3d3814886ad44ac25487b8522eaed33f + targetQuerySha256: d171b176c886aacea2906ddcc597c7784b0ef4c4d50e63b7621f5cef2e402156 + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: f52bb3503b7558bd95b70cbdb9b8791d3d3814886ad44ac25487b8522eaed33f + targetQuerySha256: d171b176c886aacea2906ddcc597c7784b0ef4c4d50e63b7621f5cef2e402156 + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: f52bb3503b7558bd95b70cbdb9b8791d3d3814886ad44ac25487b8522eaed33f + targetQuerySha256: d171b176c886aacea2906ddcc597c7784b0ef4c4d50e63b7621f5cef2e402156 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: true + aggregationWindowDifference: true + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: Query contains summarize/make-series aggregation; evaluating over the native 4-hour XDR lookback + window without an injected 1h event-time filter may aggregate up to 4 hours of events per hourly run instead of 1 + hour. + sourceDocumentSha256: f52bb3503b7558bd95b70cbdb9b8791d3d3814886ad44ac25487b8522eaed33f + targetQuerySha256: d171b176c886aacea2906ddcc597c7784b0ef4c4d50e63b7621f5cef2e402156 + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece + displayName: Snowflake - Possible data destraction + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let threshold = 10; + __xdr_inline_Snowflake + | where QueryType =~ 'DROP' + | where QueryExecutionStatus =~ 'SUCCESS' + | summarize count() by TargetUsername, bin(TimeGenerated, 5m) + | where count_ > threshold + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Possible data destraction + description: '''Detects possible data destruction.''' + severity: medium + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: Impact + techniques: + - technique: T1485 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakePrivilegesDiscovery.yaml b/Solutions/Snowflake/XDR Detections/SnowflakePrivilegesDiscovery.yaml new file mode 100644 index 00000000000..a73025c4364 --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakePrivilegesDiscovery.yaml @@ -0,0 +1,1901 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 627a4ff1-036b-4375-a9f9-288d5e1d7d37 + path: Analytic Rules/SnowflakePrivilegesDiscovery.yaml + version: 3.2.1 + querySha256: 30a897fff1248a1c3402588d655ac7231de523211161e635dcc63baf14f56252 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - Discovery + originalTechniques: + - T1087 + reviewScope: + sourceDocumentSha256: 9bfe49e64a860328b337b30eb39e1a79568590fb1a6d38cb7fd87cb8462c829c + targetQuerySha256: 172104a2338b272f8189c483e17e9f2f4bd46b4a2d336952f982076e4e05136e + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: 9bfe49e64a860328b337b30eb39e1a79568590fb1a6d38cb7fd87cb8462c829c + targetQuerySha256: 172104a2338b272f8189c483e17e9f2f4bd46b4a2d336952f982076e4e05136e + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: 9bfe49e64a860328b337b30eb39e1a79568590fb1a6d38cb7fd87cb8462c829c + targetQuerySha256: 172104a2338b272f8189c483e17e9f2f4bd46b4a2d336952f982076e4e05136e + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: 9bfe49e64a860328b337b30eb39e1a79568590fb1a6d38cb7fd87cb8462c829c + targetQuerySha256: 172104a2338b272f8189c483e17e9f2f4bd46b4a2d336952f982076e4e05136e + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37 + displayName: Snowflake - Possible privileges discovery activity + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + __xdr_inline_Snowflake + | where QueryType =~ 'SHOW' + | where QueryText has_all ('SHOW', 'ROLES') + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Possible privileges discovery activity + description: '''Detects possible privileges discovery activity.''' + severity: medium + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: Discovery + techniques: + - technique: T1087 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeQueryOnSensitiveTable.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeQueryOnSensitiveTable.yaml new file mode 100644 index 00000000000..8bfc93de3e1 --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeQueryOnSensitiveTable.yaml @@ -0,0 +1,1904 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e + path: Analytic Rules/SnowflakeQueryOnSensitiveTable.yaml + version: 3.2.1 + querySha256: 9ea4485f5dcc454a558fdaf3c747c5a9a6ecc4d87326a98cf07cece2ff6ef67d + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - Collection + originalTechniques: + - T1119 + reviewScope: + sourceDocumentSha256: 846a2daa3cdb2993f93ac04a9714f30fa4134b01c6dcf1dfa2a0430c6d999a36 + targetQuerySha256: a9206e1eb84ea496746f6e8f9af4ac9ba35946d94cf8839d42f1ddee42a69e8c + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: 846a2daa3cdb2993f93ac04a9714f30fa4134b01c6dcf1dfa2a0430c6d999a36 + targetQuerySha256: a9206e1eb84ea496746f6e8f9af4ac9ba35946d94cf8839d42f1ddee42a69e8c + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: 846a2daa3cdb2993f93ac04a9714f30fa4134b01c6dcf1dfa2a0430c6d999a36 + targetQuerySha256: a9206e1eb84ea496746f6e8f9af4ac9ba35946d94cf8839d42f1ddee42a69e8c + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: 846a2daa3cdb2993f93ac04a9714f30fa4134b01c6dcf1dfa2a0430c6d999a36 + targetQuerySha256: a9206e1eb84ea496746f6e8f9af4ac9ba35946d94cf8839d42f1ddee42a69e8c + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e + displayName: Snowflake - Query on sensitive or restricted table + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let r_tbl = dynamic(['table_name']); + __xdr_inline_Snowflake + | where QueryType =~ 'SELECT' + | where QueryExecutionStatus =~ 'SUCCESS' + | extend tbl = extract(@'(FROM|from)\s(\S+)\s', 2, QueryText) + | where tbl in~ (r_tbl) + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Query on sensitive or restricted table + description: '''Detects query on sensitive or restricted table.''' + severity: medium + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: Collection + techniques: + - technique: T1119 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeUnusualQuery.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeUnusualQuery.yaml new file mode 100644 index 00000000000..d68e24525fa --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeUnusualQuery.yaml @@ -0,0 +1,1902 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 1dd1d9e5-3ebf-43cb-be07-6082d5eabe79 + path: Analytic Rules/SnowflakeUnusualQuery.yaml + version: 3.2.1 + querySha256: a2d086708eb294a2a80434596dc005458ce34e020881852047ed448a262e21a3 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - Collection + originalTechniques: + - T1119 + reviewScope: + sourceDocumentSha256: 300127b3df5549a4465120ec6018da6fa3f83b33bfd507e3eae17a40ed8eb8f2 + targetQuerySha256: b9ddc96cc133e8c9fd1c34e91afa039c93251192768f1f29702d4d308015c4f9 + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: 300127b3df5549a4465120ec6018da6fa3f83b33bfd507e3eae17a40ed8eb8f2 + targetQuerySha256: b9ddc96cc133e8c9fd1c34e91afa039c93251192768f1f29702d4d308015c4f9 + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: 300127b3df5549a4465120ec6018da6fa3f83b33bfd507e3eae17a40ed8eb8f2 + targetQuerySha256: b9ddc96cc133e8c9fd1c34e91afa039c93251192768f1f29702d4d308015c4f9 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: 300127b3df5549a4465120ec6018da6fa3f83b33bfd507e3eae17a40ed8eb8f2 + targetQuerySha256: b9ddc96cc133e8c9fd1c34e91afa039c93251192768f1f29702d4d308015c4f9 + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79 + displayName: Snowflake - Unusual query + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + __xdr_inline_Snowflake + | where QueryType =~ 'SELECT' + | where QueryExecutionStatus =~ 'SUCCESS' + | where QueryText startswith @'SELECT *' + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Unusual query + description: '''Detects unusual query.''' + severity: medium + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: Collection + techniques: + - technique: T1119 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeUserAddAdminPrivileges.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeUserAddAdminPrivileges.yaml new file mode 100644 index 00000000000..b3c7dde6178 --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeUserAddAdminPrivileges.yaml @@ -0,0 +1,1905 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 5ed33eee-0ab6-4bf5-9e9b-6100db83d39a + path: Analytic Rules/SnowflakeUserAddAdminPrivileges.yaml + version: 3.2.1 + querySha256: a3def4a92021b8c66c193f39c3e0d0faf56a3d5d06233d26e4e17499dd5ee235 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - PrivilegeEscalation + originalTechniques: + - T1078 + reviewScope: + sourceDocumentSha256: dc2ed76b4ed3befbb5ce39c8d9412d298882b517dadc0786bdd80075c4180cd1 + targetQuerySha256: e58768ad5172346b91f015d704b5043c4de587e98a669beb1702010361817013 + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: dc2ed76b4ed3befbb5ce39c8d9412d298882b517dadc0786bdd80075c4180cd1 + targetQuerySha256: e58768ad5172346b91f015d704b5043c4de587e98a669beb1702010361817013 + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: dc2ed76b4ed3befbb5ce39c8d9412d298882b517dadc0786bdd80075c4180cd1 + targetQuerySha256: e58768ad5172346b91f015d704b5043c4de587e98a669beb1702010361817013 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: dc2ed76b4ed3befbb5ce39c8d9412d298882b517dadc0786bdd80075c4180cd1 + targetQuerySha256: e58768ad5172346b91f015d704b5043c4de587e98a669beb1702010361817013 + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a + displayName: Snowflake - User granted admin privileges + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let adm_roles = dynamic(['SECURITYADMIN', 'SYSADMIN', 'ACCOUNTADMIN']); + __xdr_inline_Snowflake + | where QueryType =~ 'GRANT' + | where QueryText startswith 'GRANT ROLE' + | extend granted_role = extract(@'GRANT ROLE\s(\S+)\sto\suser', 1, QueryText) + | where granted_role in~ (adm_roles) + | extend usr = extract(@'GRANT ROLE\s(\S+)\sto\suser(\S+)', 2, QueryText) + | extend AccountCustomEntity = usr + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - User granted admin privileges + description: '''Detects when user asigned admin privileges.''' + severity: medium + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: PrivilegeEscalation + techniques: + - technique: T1078